Banks are facing
more trouble from SpyEye, a piece of malicious software that steals money from
people's online bank accounts, according to new research from security vendor
Trusteer.

SpyEye is a
particularly nasty piece of malicious software: it can harvest credentials for
online accounts and also initiate transactions as a person is logged into their
account, literally making it possible to watch their bank balance drop by the
second.

In its latest
versions, SpyEye has been modified with new code designed to evade advanced
systems banks have put in place to try and block fraudulent transactions, said
Mickey Boodai, Trusteer's CEO.

Banks are now
analyzing how a person uses their site, looking at parameters such as how many
pages a person looks at on the site, the amount of time a person spends on a
page and the time it takes a person to execute a transaction. Other indicators
include IP address, such as if a person who normally logs in from the Miami
area suddenly logs in from St. Petersburg, Russia.

SpyEye works fast,
and can automatically and quickly initiate a transaction much faster than an
average person manually on the website. That's a key trigger for banks to block
a transaction. So SpyEye's authors are now trying to mimic -- albeit in an
automated way -- how a real person would navigate a website.

"They used to
pay less attention to the way they execute transactions on the bank's website
and now they are really trying to show normal user patterns," Boodai said.
"

Boodai said he has
little idea of how successful SpyEye's new evasion code is, although Trusteer
does collect intelligence from banks that have distributed its browser security
tool, Rapport, to their customers. Trusteer has also noticed that SpyEye in
recent months has expanded the number of financial institutions it is able to
target in an increasing number of countries.

New target countries
include Russia, Saudi Arabia, Bahrain, Oman, Venezuela, Belarus, Ukraine,
Moldova, Estonia, Latvia, Finland, Japan, Hong Kong and Peru. What that means
is that more criminal groups around the world are purchasing the SpyEye
toolkit, Boodai said.

Financial institutions
continue to increase their security spending to protect online transactions,
said Avivah Litan, an analyst at Gartner who regularly consults banks on
security issues.

Even to her,
financial institutions are coy about revealing how hard they've been hit, but
"everyone refers to Zeus or SpyEye -- some as common as the word
'teller'" Litan said.

Police have had some
limited successes. In April, a 26-year-old Lithuanian and a 45-year-old Latvian
were charged with conspiracy to cause unauthorized modifications to computers,
conspiracy to defraud and concealing proceeds from crime for allegedly using
SpyEye. A third, 26-year-old man whose nationality was not revealed was bailed
pending further questioning.

SpyEye is actually a
botnet with a network of command-and-control servers hosted around the world.
As of Tuesday, some 46 command-and-control servers were online, according to
the SpyEye Tracker, a website dedicated to gathering statistics about the malicious
software.

That is sharply up.
In May, there were just 20 or so active servers responding to computers that
were infected with SpyEye, said Roman Hüssy, who runs the site.

"SpyEye is
growing quite well," he said.

Source Code For SpyEye Trojan Published;
More Exploits On The Horizon, Researcher Says

Once costly code for data-stealing Trojan is now available to the
masses, Damballa reports

By Tim WilsonDark Reading

The
source code for SpyEye, an infamous data-stealing Trojan, has been published on
the Web and could easily be adapted and used by any savvy cybercriminal with
virtually no cost or chance of getting caught, a researcher said Monday.

"One of the most dangerous Swiss Army
knives in malware is now available to billions," said Sean Bodmer, senior
threat intelligence analyst at security vendor Damballa.

According to a blog posted by Bodmer on the
Damballa website, the SpyEye builder patch source code (release 1.3.45) was
leaked by French security researcher Xyliton, part of the Reverse Engineers
Dream (RED) Crew.

"He was able to locate a copy of
SpyEye builder 1.3.45 and created a walkthrough/tutorial that enables the
reader [once in possession of SpyEye builder] to crack the hardware
identification [HWID] which has been secured using VMProtect, a licensing tool
that locks an installation of software to a particular physical device,"
the blog says.

The SpyEye malware kit has been widely used
in cyberspace for some time now, but it generally was sold at a price of around
$10,000 -- not a price paid by the average script kiddie, Bodmer observes. Now,
with the crack, the kit is being sold inexpensively on hacker forums.

"What this means is that anybody can
use it," Bodmer says.

Perhaps just as important, the
"crack" enables malware developers to avoid the attribution that was
previously associated with the high-priced toolkit, Bodmer states. Where
previous exploits using the kit could often be traced back to the original
buyer of the toolkit, there have already been some SpyEye exploits spotted that
have no attribution, he says.

"This will make it more difficult to
track SpyEye botnets back to the source," Bodmer says.

SpyEye, which incorporated elements of the
popular Zeus Trojan earlier this year, was already ranked as one of the top three
threats on the Web this year, Bodmer says, infecting some 2 million devices.
"Now I expect that number to climb," he says, possibly even
displacing TDL and rogue antivirus threats, which occupy the other two spots in
the top three.

"SpyEye has been on everyone’s
priority list of threat discussions for quite some time, and is now going to
become an even more pervasive threat," Bodmer says. "The same thing
happened when the Zeus kit source code was released in March 2011.

"Damballa Labs has been tracking
dozens of new Zeus bot operators since the leak earlier this year -- and now
that SpyEye has been outed, it is only a matter of time before this becomes a
much larger malware threat than any we have seen to date," the blog
states. "So for the next few months, please hold onto your seats people…
this ride is about to get very interesting."